Chapter 111:5-1 Standards

(A)
These standards have been developed by
the secretary of state pursuant to Substitute House Bill 262, and shall
regulate and govern the use of the voter verified paper audit trail system in
direct recording electronic (DRE) voting machines in all elections governed by
the Ohio Revised Code. These standards shall only apply to DRE systems for
which an electronic record of the vote is created by the DRE. The standards in
this document constitute a minimum standard of performance.

(B)
Direct recording electronic voting
machine means a voting machine that records votes by means of a ballot display
provided with mechanical or electro-optical components that can be actuated by
the voter, that processes the data by means of a computer program, and that
records voting data and ballot images in internal or external memory
components. Only for the purpose of complying with the accessibility
requirements of Ohio Revised Code Section
3506.19 , optical scan marking
devices determined by the secretary of state to provide the same or
substantially similar levels of accessibility, including non-visual
accessibility, shall be considered direct recording electronic voting devices.
A direct recording electronic voting machine produces a tabulation of the
voting data stored in a removable memory component and a printed copy.

(C)
"Voter verified paper audit
trail" means a physical paper printout on which the voter's ballot choices, as
registered by a direct recording electronic voting machine, are recorded. The
voter shall be permitted to visually or audibly inspect the contents of the
physical paper printout. The physical paper printout shall be securely retained
at the polling place until the close of the polls on the day of the election;
the secretary of state shall adopt rules under Chapter 119. of the Revised Code
specifying the manner of storing the physical paper printout at the polling
place. After the physical paper printout is produced, but before the voter's
ballot is recorded, the voter shall have an opportunity to accept or reject the
contents of the printout as matching the voter's ballot choices. If a voter
rejects the contents of the physical paper printout, the system that produces
the voter verified paper audit trail shall invalidate the printout and permit
the voter to recast the voter's ballot. On and after the first federal election
that occurs after January 1, 2006, unless required sooner by the Help America
Vote Act of 2002, any system that produces a voter verified paper audit trail
shall be accessible to disabled voters, including visually impaired voters, in
the same manner as the direct recording electronic voting machine that produces
it.

(c)
These devices may be integrated as
appropriate to their operation.

(d)
A VVPAT may not be used with any voting
equipment that contains any radio frequency (RF) transmit or receive capability
or any other wireless communication device that transmits information point to
point at a distance greater than one inch.

(e)
A VVPAT may not be used with any voting
equipment beyond the physical confines of the polling place, except when used
outside a polling place in a self-contained manner to allow for curbside or
functioning similar voting.

(a)
VVPAT systems may be designed in various
configurations. In all such devices, prior to casting the ballot, the voter
shall have the ability to verify his or her selections on a paper record copy.
Before final verification, the voter shall either accept or reject the choices
represented on the paper record copy. Upon the completion of verification and
casting the ballot, both the electronic record and the paper record copy shall
be stored and retained.

(b)
Any
system that produces a voter verified paper audit trail shall be accessible to
disabled voters, including visually impaired voters, in the same manner as the
direct recording electronic voting machine that produces it.

(3)
Maintenance: VVPAT system
design shall permit routine maintenance in a manner that prevents the risk of
undetected tampering or unauthorized altering of certified system components
during routine system maintenance.

(i)
Every electronic record must have
a corresponding paper ballot record copy.

(a)
The paper ballot record copy must be printed and the voter must have the
opportunity to verify that record prior to the final electronic record being
recorded.

(b)
A unique DRE
identifier must appear on each individual paper ballot record produced, without
revealing the identity of the voter who cast the ballot.

(ii)
For any recount of an election in which
ballots are cast using a direct recording electronic voting machine with a
voter verified paper audit trail, the voter verified paper audit trail shall
serve as the official ballot to be recounted.

(iii)
In the case of a difference between the
electronic record and the paper record copy, the paper record copy shall
govern, unless there is clear evidence that the paper record copy is
inaccurate, incomplete or unreadable as defined in the system procedures.

(iv)
The voter verified paper
audit trail shall be preserved in the same manner and for the same time period
as paper ballots are preserved under section
3505.31 of the Revised Code.

(b)
Privacy: The VVPAT
system shall be designed to allow every voter to review, accept or reject
his/her paper record copy privately and independently and shall comply with
federal and state privacy requirements.

(c)
Secrecy: The VVPAT system shall be
designed to ensure secrecy of votes so that it is not possible to determine
which voter cast which paper record copy and shall comply with federal and
state secrecy requirements.

(i)
The VVPAT system shall be
designed to maximize the ease in which the voter may review, accept or reject
his/her paper record copy and shall comply with federal and state readability
requirements.

(a)
The headline should be
printed in no smaller than twenty-five point font, however, if the vendor
cannot print the headline in at least twenty-five point font then they have the
option of using a typeface of not less then nine point font and the VVPAT
machine must include magnification capability to read the font as if it were
thirty point font.

(b)
The ballot
language, explanation and arguments must be printed in no smaller than nine
point font and no larger than eighteen point font and the machine must include
a magnification capability read the font as if it were thirty point font.

(c)
The ballot typeface must be
times new roman, arial, myriad, or its equivalent.

(ii)
On and after the first federal election
that occurs after January 1, 2006, unless required sooner by the help america
vote act of 2002, the voter verified paper audit trail shall be capable of
being optically scanned for the purpose of conducting a recount or other audit
of the voting machine and shall be readable in a manner that makes the voter's
ballot choices obvious to the voter without the use of computer or electronic
codes.

(e)
Accessibility: The VVPAT system shall be designed to allow access for disabled
and limited literacy voters to privately and independently use the VVPAT and
shall comply with federal and state accessibility requirements.

(f)
Language accessibility: The VVPAT system
shall be designed to allow each voter to verify their vote on a paper record
copy in the same language they voted in on the DRE and shall comply with
federal and state requirements.

(g)
Security: The VVPAT system shall be
designed to prevent tampering with either the VVPAT system or the paper record
copy, and shall comply with federal and state security requirements.

(h)
Capacity: The VVPAT system shall be
designed with a combined capacity to ensure that an adequate amount of all the
paper record, ink, toner, ribbon or other like supply units in a precinct will
accommodate all voters using the DRE's with VVPAT-W within the precinct.

(i)
The VVPAT system shall be
designed to ensure that poll workers will not be required to add paper record,
ink, toner, ribbon or other like supply units to the VVPAT-W, more than once,
during the polling hours.

(i)
The VVPAT system must be
designed to prohibit the production by any direct recording electronic voting
machine of anything that legally could be removed by the voter from the polling
place, such as a receipt or voter confirmation.

(ii)
The VVPAT system must provide a low
supply warning to provide a poll worker the opportunity to add paper, ink,
toner, ribbon or other like supply before the supply item runs out.

(a)
In the event a supply warning occurs as a
voter is casting a ballot, the VVPAT must safeguard the secrecy of the ballot
by preventing the poll worker from reading the VVPAT ballot.

(b)
After the poll worker has filled the
supply, the system shall allow the voter to review their VVPAT ballot without
having to recast their ballot.

(j)
Capability: The VVPAT device should draw
its power from the DRE or the same electrical circuit the DRE draws its power
from.

(i)
When not plugged into an AC power
source, the battery used to power the DRE must also power the VVPAT. However, a
separate battery can be used to power the VVPAT as long as the voting process
cannot continue if the VVPAT is not operational.

(ii)
The battery must provide sufficient
power to supply both the DRE and VVPAT device for at least two hours, or
federal and state standards, which ever is more stringent.

(a)
Security: Security protections shall be
built into the paper record copy and/or VVPAT-S to prevent tampering. This
provision shall apply to paper record copies before, during and after printing.

(b)
Readability: The paper shall
be designed so as to make the paper record copy readable by voters and election
officials and shall comply with state readability requirements.

(c)
Retention: The voter verified paper
record copy shall be retained by the elections official for the same period of
time as mandated by state law for the retention of paper ballots for that
election.

(a)
Security: The printer shall be physically
secure from tampering. The paper record copy and the image created by the
VVPAT-W on the paper record copy shall be designed to withstand storage
requirements as outlined in these standards and state requirements.

(b)
Readability: The image created by the
printer shall be designed to allow a voter to review his or her paper record
copy privately and independently.

(i)
The
headline should be printed in no smaller than twenty-five point font, however,
if the vendor cannot print the headline in at least twenty-five point font then
they have the option of using a typeface of not less then nine point font and
the VVPAT machine must include magnification capability to read the font as if
it were thirty point font.

(ii)
The ballot language, explanation and arguments must be printed in no smaller
than nine point type and the machine must include a magnification capability
read the font as if it were thirty point.

(iii)
The VVPAT must be printed using black
ink, toner, or chemical agent on white paper.

(iv)
The VVPAT must be printed using
typeface/font of times new roman, arial, myriad, or its equivalent.

(v)
The VVPAT must be printed using a paper
weight of no less than fifteen pounds.

(a)
The image created by the VVPAT-W shall be
clearly identifiable in the case of a spoiled paper record copy. The clearly
identifiable spoiled paper record copy shall be shown in the paper record
display unit to allow the voter to acknowledge the paper record copy has been
spoiled. The VVPAT system shall be designed to prevent a paper record copy from
being spoiled after the voter has verified that paper record copy and has cast
his/her ballot.

(b)
The voter
shall have the opportunity to affirmatively spoil their paper record copy no
more than two times. An error in recording or printing a paper record copy not
caused by the voter shall not be counted as a spoiled paper record copy.

(c)
Upon spoiling their paper
record copy the voter shall be able to modify and verify selections on the DRE
without having to reselect all of their choices.

(d)
Before the voter causes a third and final
paper record copy to be printed, the voter shall be presented with a warning
notice that the selections made on screen will be final and the voter will see
and verify a printout of their vote, but will not be given additional
opportunities to change their vote.

(a)
Security: The paper record display unit
shall allow the voter to inspect the paper record copy without physically
handling the paper record copy and shall be physically secure from tampering.

(b)
Readability: The paper record
display unit shall provide adequate visual space to allow the voter to
privately and independently inspect the paper record copy. A paper record copy
shall be readable from the same position and posture used for voting on the
DRE. The voter shall have the ability to view both the review screen on the DRE
and the paper record copy in the display unit simultaneously. If the paper
record copy cannot be viewed in its entirety in the paper record display unit
at one time, then the voter shall have the opportunity to verify the entire
paper record copy prior to either the electronic record or the paper record
copy being stored and recorded.

(i)
Covering:
Any protective covering intended to be transparent shall be in such condition
that it can be made transparent by ordinary cleaning of its exposed surface.

(c)
Accessibility: The
VVPAT components must conform to federal and state accessibility requirements.

(a)
Security: The paper record storage unit
shall be designed to prevent tampering.

(b)
Secrecy: The VVPAT system shall be
designed and proper procedures put in place to ensure the printed ballot audit
trail is stored in a manner to ensure secrecy of votes so that it is not
possible to determine which voter cast which paper record copy.

(c)
Capacity: The combined capacity of all
the paper record storage units in a precinct must be enough to accommodate all
voters using the DREs within the precinct.

(1)
Update: Testing and certification,
pre-election, election and post-election procedures for each DRE voting system
shall be updated to reflect the use of the VVPAT. These updates include, but
are not limited to:

(i)
Testing: The VVPAT system
shall conform to federal and state testing requirements. Required testing shall
include, but not be limited to, functionality, security, durability, longevity
and accessibility testing.

(ii)
Certification: The VVPAT system must be certified for use by the state of Ohio
in conjunction with the rest of the voting system with which it is intended to
be used.

(iii)
Configuration: The
VVPAT system shall not, at any time, contain or use undisclosed hardware or
software. The only components that may be used in the system are components
that have been tested and certified for use in the state of Ohio.

(b)
Pre-election procedures: The
VVPAT system components must be integrated into existing local logic and
accuracy testing requirements.

(i)
Written procedures shall reflect the use
of the paper record copies in the required full manual recount as defined under
state requirements.

(ii)
The
vendor shall include written recommendations for how the secrecy of votes will
be ensured.

(iii)
The vendor shall
include written recommendations for how a discrepancy between an electronic
record and its corresponding paper record copy shall be identified,
investigated and resolved.

(a)
The vendor
shall include written recommendations for determining what constitutes clear
evidence that a paper record copy is inaccurate, incomplete or unreadable.

(G)
In order to provide the secretary
information pertinent to the implementation of the voting machines and the
security of the voting machines, the individual voting machine vendors must
meet the following requirements:

(1)
Vendors
shall produce all documentation describing materials, equipment, programs, and
procedures, including source codes, scripts, and data files, required to
develop, install or operate any software, firmware or hardware used in the
voting system.

(2)
Vendor shall
produce the following documents submitted to or resulting from the federal
testing and qualification or re-qualification process regarding voting systems:

(b)
Within thirty days of testing, Vendor shall furnish secretary with all test
reports in the vendor's possession, both published final and intermediate
statue reports showing discovered deficiencies and resolution steps.

(3)
Vendor shall produce the
following documents relating to each hardware, software and firmware version
for any component of the voting system: detailed change logs, hardware change
records or logs, test records relating to the changed components, and documents
describing the effects of the changes.

(4)
Vendor shall execute and deliver to the
secretary of state an authorization in a format reasonably acceptable to vendor
and independent testing authorities, to enable the secretary of state to obtain
information about the status of federal testing and qualifications of vendors
voting systems proposed to be used in Ohio.

(5)
Vendor shall notify, within two business
days, the secretary of state of problems encountered in Ohio and other
jurisdictions, whether upon completion of testing or in an actual election,
which vendor concludes would reasonably create an impediment to obtaining
certification.

(6)
Vendor shall
maintain in good working order, provided the following are subjected only to
normal wear and tear and proper usage, one working version of vendor's voting
system, a server containing election management system and peripherals proposed
to be used in any Ohio election.

(7)
Vendor shall provide the secretary a
statement identifying the voting system supplied and affirming that each voting
system is state certified at the time of vendor's statement.

(a)
Replace hard-coded
supervisor passwords with dynamic passwords, and provide directions and
training to enable election officials to change these passwords if election
officials choose to do so.

(b)
Use
secure data transmissions between touchscreen terminals and the server.

(c)
There shall not be vendor
controlled security keys and the encryption code shall be programmable by
county.

(9)
Vendor
shall notify secretary of state and the counties, where the vendors system is
in use, of any security patches or other software upgrades that vendor
recommends to be installed on the server. Vendor shall notify the secretary of
any security patches which vendor recommends not be used.